PT-2022-21657 · Libredwg · Libredwg

Cxlzff · Published 2022-06-22 · Updated 2023-01-23 · CVE-2022-33032

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibreDWG version 0.12.4.4608

Description The issue is related to a heap-buffer-overflow in the decode preR13 section hdr function located at decode r11.c. This overflow can potentially lead to memory corruption and execution of arbitrary code.

Recommendations For LibreDWG version 0.12.4.4608, consider restricting access to the decode preR13 section hdr function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2022-33032

Affected Products

Libredwg

References · 4

• 🔥 https://github.com/LibreDWG/libredwg/issues/488 · Exploit
• https://osv.dev/vulnerability/CVE-2022-33032 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33032 · Security Note
• https://t.me/cibsecurity/45006 · Telegram Post